ApplicationOverride results in "Unable to locate an encrypted key"

[Cantor, Scott]

Basic advice:

Never use different keys with overrides, that doesn't really serve any purpose.

The error is because of the key name information the IdP is probably embedding in the message.

There are no "correct" names in an SP certificate used for authentication, signing, or encryption. Only the key matters. Screwing around with the names will create errors where none would have existed.

-- Scott